Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
N
nghttp2
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Libraries
nghttp2
Commits
5b42815a
Commit
5b42815a
authored
Sep 09, 2018
by
Tatsuhiro Tsujikawa
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
nghttpx: Strip incoming Early-Data header field by default
parent
cfe7fa9a
Changes
9
Hide whitespace changes
Inline
Side-by-side
Showing
9 changed files
with
55 additions
and
3 deletions
+55
-3
genheaderfunc.py
genheaderfunc.py
+1
-0
gennghttpxfun.py
gennghttpxfun.py
+1
-0
src/http2.cc
src/http2.cc
+15
-0
src/http2.h
src/http2.h
+6
-1
src/shrpx.cc
src/shrpx.cc
+11
-0
src/shrpx_config.cc
src/shrpx_config.cc
+9
-0
src/shrpx_config.h
src/shrpx_config.h
+6
-0
src/shrpx_http2_downstream_connection.cc
src/shrpx_http2_downstream_connection.cc
+3
-1
src/shrpx_http_downstream_connection.cc
src/shrpx_http_downstream_connection.cc
+3
-1
No files found.
genheaderfunc.py
View file @
5b42815a
...
...
@@ -31,6 +31,7 @@ HEADERS = [
"user-agent"
,
"date"
,
"content-type"
,
"early-data"
,
# disallowed h1 headers
'connection'
,
'keep-alive'
,
...
...
gennghttpxfun.py
View file @
5b42815a
...
...
@@ -174,6 +174,7 @@ OPTIONS = [
"tls-max-early-data"
,
"tls13-ciphers"
,
"tls13-client-ciphers"
,
"no-strip-incoming-early-data"
,
]
LOGVARS
=
[
...
...
src/http2.cc
View file @
5b42815a
...
...
@@ -389,6 +389,11 @@ void copy_headers_to_nva_internal(std::vector<nghttp2_nv> &nva,
case
HD_TRANSFER_ENCODING
:
case
HD_UPGRADE
:
continue
;
case
HD_EARLY_DATA
:
if
(
flags
&
HDOP_STRIP_EARLY_DATA
)
{
continue
;
}
break
;
case
HD_FORWARDED
:
if
(
flags
&
HDOP_STRIP_FORWARDED
)
{
continue
;
...
...
@@ -483,6 +488,11 @@ void build_http1_headers_from_headers(DefaultMemchunks *buf,
case
HD_SERVER
:
case
HD_UPGRADE
:
continue
;
case
HD_EARLY_DATA
:
if
(
flags
&
HDOP_STRIP_EARLY_DATA
)
{
continue
;
}
break
;
case
HD_FORWARDED
:
if
(
flags
&
HDOP_STRIP_FORWARDED
)
{
continue
;
...
...
@@ -828,6 +838,11 @@ int lookup_token(const uint8_t *name, size_t namelen) {
break
;
case
10
:
switch
(
name
[
9
])
{
case
'a'
:
if
(
util
::
streq_l
(
"early-dat"
,
name
,
9
))
{
return
HD_EARLY_DATA
;
}
break
;
case
'e'
:
if
(
util
::
streq_l
(
"keep-aliv"
,
name
,
9
))
{
return
HD_KEEP_ALIVE
;
...
...
src/http2.h
View file @
5b42815a
...
...
@@ -203,9 +203,13 @@ enum HeaderBuildOp {
// Via header fields must be stripped. If this flag is not set, all
// Via header fields other than last one are added.
HDOP_STRIP_VIA
=
1
<<
3
,
// Early-Data header fields must be stripped. If this flag is not
// set, all Early-Data header fields are added.
HDOP_STRIP_EARLY_DATA
=
1
<<
4
,
// Strip above all header fields.
HDOP_STRIP_ALL
=
HDOP_STRIP_FORWARDED
|
HDOP_STRIP_X_FORWARDED_FOR
|
HDOP_STRIP_X_FORWARDED_PROTO
|
HDOP_STRIP_VIA
,
HDOP_STRIP_X_FORWARDED_PROTO
|
HDOP_STRIP_VIA
|
HDOP_STRIP_EARLY_DATA
,
};
// Appends headers in |headers| to |nv|. |headers| must be indexed
...
...
@@ -304,6 +308,7 @@ enum {
HD_CONTENT_TYPE
,
HD_COOKIE
,
HD_DATE
,
HD_EARLY_DATA
,
HD_EXPECT
,
HD_FORWARDED
,
HD_HOST
,
...
...
src/shrpx.cc
View file @
5b42815a
...
...
@@ -1487,6 +1487,7 @@ void fill_default_config(Config *config) {
httpconf
.
max_requests
=
std
::
numeric_limits
<
size_t
>::
max
();
httpconf
.
xfp
.
add
=
true
;
httpconf
.
xfp
.
strip_incoming
=
true
;
httpconf
.
early_data
.
strip_incoming
=
true
;
auto
&
http2conf
=
config
->
http2
;
{
...
...
@@ -2644,6 +2645,9 @@ HTTP:
Default: obfuscated
--no-via Don't append to Via header field. If Via header field
is received, it is left unaltered.
--no-strip-incoming-early-data
Don't strip Early-Data header field from inbound client
requests.
--no-location-rewrite
Don't rewrite location header field in default mode.
When --http2-proxy is used, location header field will
...
...
@@ -3475,6 +3479,8 @@ int main(int argc, char **argv) {
{
SHRPX_OPT_TLS_MAX_EARLY_DATA
.
c_str
(),
required_argument
,
&
flag
,
163
},
{
SHRPX_OPT_TLS13_CIPHERS
.
c_str
(),
required_argument
,
&
flag
,
164
},
{
SHRPX_OPT_TLS13_CLIENT_CIPHERS
.
c_str
(),
required_argument
,
&
flag
,
165
},
{
SHRPX_OPT_NO_STRIP_INCOMING_EARLY_DATA
.
c_str
(),
no_argument
,
&
flag
,
166
},
{
nullptr
,
0
,
nullptr
,
0
}};
int
option_index
=
0
;
...
...
@@ -4263,6 +4269,11 @@ int main(int argc, char **argv) {
// --tls13-client-ciphers
cmdcfgs
.
emplace_back
(
SHRPX_OPT_TLS13_CLIENT_CIPHERS
,
StringRef
{
optarg
});
break
;
case
166
:
// --no-strip-incoming-early-data
cmdcfgs
.
emplace_back
(
SHRPX_OPT_NO_STRIP_INCOMING_EARLY_DATA
,
StringRef
::
from_lit
(
"yes"
));
break
;
default:
break
;
}
...
...
src/shrpx_config.cc
View file @
5b42815a
...
...
@@ -2186,6 +2186,11 @@ int option_lookup_token(const char *name, size_t namelen) {
break
;
case
28
:
switch
(
name
[
27
])
{
case
'a'
:
if
(
util
::
strieq_l
(
"no-strip-incoming-early-dat"
,
name
,
27
))
{
return
SHRPX_OPTID_NO_STRIP_INCOMING_EARLY_DATA
;
}
break
;
case
'd'
:
if
(
util
::
strieq_l
(
"tls-dyn-rec-warmup-threshol"
,
name
,
27
))
{
return
SHRPX_OPTID_TLS_DYN_REC_WARMUP_THRESHOLD
;
...
...
@@ -3626,6 +3631,10 @@ int parse_config(Config *config, int optid, const StringRef &opt,
case
SHRPX_OPTID_TLS_MAX_EARLY_DATA
:
{
return
parse_uint_with_unit
(
&
config
->
tls
.
max_early_data
,
opt
,
optarg
);
}
case
SHRPX_OPTID_NO_STRIP_INCOMING_EARLY_DATA
:
config
->
http
.
early_data
.
strip_incoming
=
!
util
::
strieq_l
(
"yes"
,
optarg
);
return
0
;
case
SHRPX_OPTID_CONF
:
LOG
(
WARN
)
<<
"conf: ignored"
;
...
...
src/shrpx_config.h
View file @
5b42815a
...
...
@@ -354,6 +354,8 @@ constexpr auto SHRPX_OPT_TLS_MAX_EARLY_DATA =
constexpr
auto
SHRPX_OPT_TLS13_CIPHERS
=
StringRef
::
from_lit
(
"tls13-ciphers"
);
constexpr
auto
SHRPX_OPT_TLS13_CLIENT_CIPHERS
=
StringRef
::
from_lit
(
"tls13-client-ciphers"
);
constexpr
auto
SHRPX_OPT_NO_STRIP_INCOMING_EARLY_DATA
=
StringRef
::
from_lit
(
"no-strip-incoming-early-data"
);
constexpr
size_t
SHRPX_OBFUSCATED_NODE_LENGTH
=
8
;
...
...
@@ -704,6 +706,9 @@ struct HttpConfig {
bool
add
;
bool
strip_incoming
;
}
xfp
;
struct
{
bool
strip_incoming
;
}
early_data
;
std
::
vector
<
AltSvc
>
altsvcs
;
std
::
vector
<
ErrorPage
>
error_pages
;
HeaderRefs
add_request_headers
;
...
...
@@ -1100,6 +1105,7 @@ enum {
SHRPX_OPTID_NO_OCSP
,
SHRPX_OPTID_NO_SERVER_PUSH
,
SHRPX_OPTID_NO_SERVER_REWRITE
,
SHRPX_OPTID_NO_STRIP_INCOMING_EARLY_DATA
,
SHRPX_OPTID_NO_STRIP_INCOMING_X_FORWARDED_PROTO
,
SHRPX_OPTID_NO_VERIFY_OCSP
,
SHRPX_OPTID_NO_VIA
,
...
...
src/shrpx_http2_downstream_connection.cc
View file @
5b42815a
...
...
@@ -320,11 +320,13 @@ int Http2DownstreamConnection::push_request_headers() {
auto
&
fwdconf
=
httpconf
.
forwarded
;
auto
&
xffconf
=
httpconf
.
xff
;
auto
&
xfpconf
=
httpconf
.
xfp
;
auto
&
earlydataconf
=
httpconf
.
early_data
;
uint32_t
build_flags
=
(
fwdconf
.
strip_incoming
?
http2
::
HDOP_STRIP_FORWARDED
:
0
)
|
(
xffconf
.
strip_incoming
?
http2
::
HDOP_STRIP_X_FORWARDED_FOR
:
0
)
|
(
xfpconf
.
strip_incoming
?
http2
::
HDOP_STRIP_X_FORWARDED_PROTO
:
0
);
(
xfpconf
.
strip_incoming
?
http2
::
HDOP_STRIP_X_FORWARDED_PROTO
:
0
)
|
(
earlydataconf
.
strip_incoming
?
http2
::
HDOP_STRIP_EARLY_DATA
:
0
);
http2
::
copy_headers_to_nva_nocopy
(
nva
,
req
.
fs
.
headers
(),
build_flags
);
...
...
src/shrpx_http_downstream_connection.cc
View file @
5b42815a
...
...
@@ -540,11 +540,13 @@ int HttpDownstreamConnection::push_request_headers() {
auto
&
fwdconf
=
httpconf
.
forwarded
;
auto
&
xffconf
=
httpconf
.
xff
;
auto
&
xfpconf
=
httpconf
.
xfp
;
auto
&
earlydataconf
=
httpconf
.
early_data
;
uint32_t
build_flags
=
(
fwdconf
.
strip_incoming
?
http2
::
HDOP_STRIP_FORWARDED
:
0
)
|
(
xffconf
.
strip_incoming
?
http2
::
HDOP_STRIP_X_FORWARDED_FOR
:
0
)
|
(
xfpconf
.
strip_incoming
?
http2
::
HDOP_STRIP_X_FORWARDED_PROTO
:
0
);
(
xfpconf
.
strip_incoming
?
http2
::
HDOP_STRIP_X_FORWARDED_PROTO
:
0
)
|
(
earlydataconf
.
strip_incoming
?
http2
::
HDOP_STRIP_EARLY_DATA
:
0
);
http2
::
build_http1_headers_from_headers
(
buf
,
req
.
fs
.
headers
(),
build_flags
);
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment